What is the CVSS score of CVE-2026-60744?

CVE-2026-60744 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle Cost Management CVE-2026-60744

EUVD-2026-47078 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cpr6-hggx-m84c

Oracle Authentication Bypass Cost Management

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network HTTP delivery confirmed, AC:H per Oracle's 'difficult to exploit' characterization, PR:L for required low-privilege account, no availability impact described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:53 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Oracle Cost Management is a module within Oracle E-Business Suite (EBS), a widely deployed enterprise resource planning platform used in manufacturing, supply chain, and financial operations. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that authorization enforcement within this component can be circumvented by an attacker who already holds a low-privilege EBS account. No CWE classification was assigned by Oracle or NVD, leaving the precise root cause class - whether broken function-level authorization, parameter tampering, or access to privileged HTTP endpoints without adequate checks - unconfirmed. The attack surface is the EBS web application tier, consistent with AV:N/HTTP delivery via Oracle EBS's browser-based architecture. Affected CPE spans Oracle EBS 12.2.3 through 12.2.15 per the July 2026 Critical Patch Update advisory and EUVD-2026-47078.

RemediationAI

The primary remediation is to apply the patches included in the Oracle Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Organizations running Oracle EBS should follow Oracle's standard CPU patch application process for the E-Business Suite 12.2.x release line. An exact patched version number is not independently verifiable from the available data beyond the CPU advisory reference - consult the My Oracle Support patch delivery portal for the specific patch ID. As a compensating control while patch scheduling is underway, restrict network-layer access to the Oracle EBS application tier to only authorized client IP ranges using firewall or load-balancer ACLs, reducing the effective network attack surface (AV:N) without requiring application changes; note this may disrupt remote or mobile EBS users on dynamic IPs. Additionally, audit and reduce the population of low-privilege EBS accounts with access to Oracle Cost Management, applying least-privilege principles to narrow the PR:L attack surface. Avoid relying solely on network controls as a long-term substitute for patching.